Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replaced "sanitize" with "no-sanitize". #86

Closed
wants to merge 2 commits into from
Closed

Replaced "sanitize" with "no-sanitize". #86

wants to merge 2 commits into from

Conversation

TomCools
Copy link

Made santize for all content the default and added a "no-sanitize" boolean property so you can disable this default.

It was mentioned in an Issues, but I decided to just go ahead and create the MR for it.

Fixes #40

…en when binding to the markdown-property or by embedding it as content.
@googlebot
Copy link

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.


  • If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address on your commit. Check your existing CLA data and verify that your email is set on your git commits.
  • If your company signed a CLA, they designated a Point of Contact who decides which employees are authorized to participate. You may need to contact the Point of Contact for your company and ask to be added to the group of authorized contributors. If you don't know who your Point of Contact is, direct the project maintainer to go/cla#troubleshoot. The email used to register you as an authorized contributor must be the email used for the Git commit.
  • In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. If the bot doesn't comment, it means it doesn't think anything has changed.

@TomCools
Copy link
Author

I signed it!

@googlebot
Copy link

We found a Contributor License Agreement for you (the sender of this pull request), but were unable to find agreements for the commit author(s). If you authored these, maybe you used a different email address in the git commits than was used to sign the CLA (login here to double check)? If these were authored by someone else, then they will need to sign a CLA as well, and confirm that they're okay with these being contributed to Google.
In order to pass this check, please resolve this problem and have the pull request author add another comment and the bot will run again. If the bot doesn't comment, it means it doesn't think anything has changed.

@TomCools
Copy link
Author

I signed it!

@googlebot
Copy link

CLAs look good, thanks!

@e111077
Copy link
Contributor

e111077 commented Feb 12, 2018

Heya, thanks for the PR, my reservations about this are:

  1. This is inherently a breaking change
  2. Goes against Google style guidelines where booleans should not be named negatively (noSanitize / dontSanitize vs sanitize)

Perhaps unsanitized is a better name.

Since this is a breaking change I will have to run more-extensive internal integration tests to see the extent of the breakages and determine if it's fixable and does not break too many targets.

@@ -142,9 +142,9 @@
value: null
},
/**
* Sanitize the output. Ignore any HTML that has been input.
* Do not sanitize the output. Default ignores any HTML that has been input.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Better phrasing:

Disable sanitization. Default: Ignore any HTML tags contained within the input.

@MajorBreakfast
Copy link
Contributor

MajorBreakfast commented Feb 21, 2018

About the naming: I just wanted to mention that it's not uncommon that properties start with "no".
https://www.webcomponents.org/element/PolymerElements/paper-dialog/elements/paper-dialog
https://www.webcomponents.org/element/PolymerElements/paper-button/elements/paper-button
However, "unsanitized" sounds good.

I'm generally a big fan of the "safe by default" mentality. However, I do not think that it is wise to merge this. This will definitely break things. It'd be good if there was a deprecation warning to raise awareness first and to let sanitize and no-sanitize exist in parallel for a about a year or so.

@e111077
Copy link
Contributor

e111077 commented Feb 23, 2018

I can confirm that this is causing significant breakages across Google.

In terms of naming; I swear I saw this in one of our style guides but I can't seem to find it. noSanitize is okay

@e111077
Copy link
Contributor

e111077 commented Feb 23, 2018

Overall, due to the breaking changes, I'm going to have to close this PR. noSanitize living parallel to sanitize is going to cause a lot of trouble and historically users don't tend to listen to warnings which will just break a lot of users.

@e111077 e111077 closed this Feb 23, 2018
@TomCools TomCools deleted the sanitize_default_true branch March 2, 2018 06:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants